GDPR evidence on demand — RoPA, DSARs, breach reports and DPIAs from one source of truth.
GDPR rewards organisations that can show their work and punishes the ones that can't. Lojycal turns the Record of Processing, DSAR fulfilment, breach notifications and DPIAs into a live, signed evidence stream — so the next supervisory authority request is a same-day export, not a fire drill.
What GDPR actually demands
Regulation (EU) 2016/679 has applied since May 2018, but enforcement has accelerated sharply since 2023. Supervisory authorities now expect demonstrable, not just claimed, compliance.
Record of Processing Activities (RoPA)
Article 30 requires every controller and processor to maintain an up-to-date RoPA — categories of data, purposes, recipients, retention, transfers, safeguards.
Data Subject Access Requests
Article 15 requests must be answered within one month, free of charge, with a complete copy of personal data being processed and the metadata around it.
Personal data breach notifications
Article 33 mandates notification to the supervisory authority within 72 hours of becoming aware of a notifiable breach, with structured content.
Data Protection Impact Assessments
Article 35 requires a DPIA for high-risk processing — including most large-scale automated decision-making, including profiling.
The Lojycal GDPR engine
Four connected workspaces produce every artefact your DPO, your legal team, or a supervisory authority will ask for.
Record of Processing
Living Art. 30 record built from SaaS inventory, data flows and processing purposes. Controller and processor entries, with last-reviewed date and DPO sign-off.
Trust Center → RoPA
DSAR fulfilment
DSAR intake, identity verification, data discovery across connected systems, redaction workflow, and a packaged response — with a WORM record of every step.
Workflows + Data Governance
Breach notification
Detected events flow into the breach ledger. Notifiable breaches auto-open an Art. 33 draft populated with categories, approximate counts, likely consequences and mitigations.
SIEM + Incident Ledger
DPIA workspace
DPIA template wired to the processing record and the risk register. Each DPIA versioned, with consultation evidence and DPO sign-off.
Trust Center → DPIA
GDPR articles → Lojycal controls
Lojycal automatically produces evidence for the operational obligations across Chapters II–IV. A sampled view:
| GDPR area | Example obligation | Lojycal source |
|---|---|---|
| Ch. II — Principles | Art. 5 — Accountability | Audit Log + Evidence Pack |
| Ch. III — Rights | Art. 15 — Right of access (DSAR) | Workflows → DSAR |
| Ch. III — Rights | Art. 17 — Right to erasure | Workflows → Erasure |
| Ch. III — Rights | Art. 20 — Right to data portability | Workflows → Export |
| Ch. IV — Controller | Art. 30 — Records of processing | Trust Center → RoPA |
| Ch. IV — Security | Art. 32 — Security of processing | Trust Center → Posture |
| Ch. IV — Breach | Art. 33 — Notification within 72h | Incident Ledger → Report Builder |
| Ch. IV — DPIA | Art. 35 — DPIA on high-risk processing | Trust Center → DPIA |
| Ch. V — Transfers | Art. 44+ — International transfers | Vendor Governance → Transfer Map |
Sampled — not exhaustive. Coverage depends on which Lojycal modules and connectors you have enabled.
Demonstrable, not claimed, compliance
Article 5(2) is the unforgiving clause: the controller is responsible for, AND must be able to demonstrate, compliance with the principles. A policy on a PDF doesn't demonstrate anything.
Lojycal writes every DSAR fulfilment, every breach decision, every DPIA review and every retention enforcement to a WORM (write-once, read-many) audit log. The Trust Center bundles selected windows into a signed Evidence Pack — JSON, CSV and PDF, with a detached HMAC signature using a per-organisation key — that your DPO can hand to a supervisory authority without preparation.
From RoPA to supervisory-ready — a 90-day path
Most GDPR programmes drift between annual reviews and crisis modes. Lojycal turns it into a steady operational loop, with the artefacts always one click from current.
- Days 0–30
Phase 1 — RoPA & lawful basis
Generate the Record of Processing from SaaS inventory and data flows. Assign lawful basis, retention and DPO ownership per processing activity. Identify Art. 35 candidates for DPIA.
- Days 31–60
Phase 2 — DSAR & breach plumbing
Wire DSAR intake to identity verification and data discovery. Connect SIEM/EDR to the breach ledger. Rehearse a tabletop Art. 33 notification end-to-end.
- Days 61–90
Phase 3 — DPIA & transfers
Complete DPIAs for the highest-risk processing activities. Map international transfers, SCCs and TIAs. Produce a signed Evidence Pack and DPO report.
GDPR evidence automation — common questions
What is GDPR evidence automation?
GDPR evidence automation is the practice of generating the Record of Processing, DSAR fulfilment records, breach notifications and DPIAs directly from live operational systems — instead of producing them manually before each DPO review or supervisory request. Lojycal automates the RoPA, the DSAR workflow, the breach report builder and the DPIA workspace end-to-end.
Does Lojycal replace our DPO?
No. A Data Protection Officer (where required under Art. 37) is a designated role with statutory independence. Lojycal automates the artefacts the DPO supervises — the RoPA, DSAR records, breach decisions, DPIAs and the evidence pack the supervisory authority will request — so the DPO spends time on judgement, not paperwork.
How does the 72-hour breach notification flow work?
Detected events flow from SIEM, EDR, MDM, SaaS and database connectors into the breach ledger. Lojycal applies the Art. 33 trigger criteria (categories of data, likelihood of risk to rights and freedoms, approximate counts) and surfaces incidents that meet the notifiable threshold. An Art. 33 notification draft is pre-populated for your lead supervisory authority — the DPO reviews, edits and submits inside the 72-hour window.
How is the RoPA kept current?
The RoPA is a living document inside the Trust Center, not a Word file. It is generated from SaaS inventory (which systems exist), data discovery (what personal data they touch) and workflows (what processing they do). A change to scope (a new SaaS, a new data flow, a removed integration) updates the RoPA automatically; the DPO signs off material changes via the audit log.
What about international transfers under Schrems II?
Lojycal's Vendor Governance module maps every vendor's data-processing location, sub-processor chain and transfer mechanism (adequacy decision, SCCs, BCRs). The Transfer Impact Assessment (TIA) workspace records the local-law analysis and supplementary measures per transfer. Drift — a vendor changes sub-processor or region — triggers a re-review.
How does GDPR overlap with NIS2 and the AI Act?
Substantially. NIS2 Art. 21 cyber-hygiene and incident-handling measures overlap with GDPR Art. 32 security obligations; an Art. 33 personal-data breach is often also a notifiable NIS2 incident. The AI Act layers technical-documentation and human-oversight duties on top of GDPR data-minimisation and DPIA duties for AI processing personal data. Lojycal's Trust Center cross-links these so the same underlying evidence covers all three regimes.
Make GDPR demonstrable, not aspirational.
Every processing activity. Every data subject request. Every breach decision. Every DPIA. One signed source of truth.